Enable Devise paranoid mode and ensure the returned message is the same
every time. This will prevent user enumeration (low impact).
Prior to this change a user could type an email in the password reset
field and if the email didn't exist it returned an error. If the email
was valid it returned a message saying the forgot password link had been
emailed. After this change the user will receive a message that if the
email is in our database the reset link will be emailed.
I also changed the throttle mechanism so it still works the same but
now returns the exact same message as above. Previously it would say
'You've already sent a request. Wait a few minutes'. This also allows
user enumeration, although it requires a double-check.
Related to https://dev.gitlab.org/gitlab/gitlabhq/issues/2624
See merge request !2044
refactor login as to be impersonation with better login/logout
Modifies the existing "login as" feature to be called impersonation.
This also adds:
* Application keep track of who is impersonating the user so they can revert back to the original user without having to log out.
* Stores the user profile via `HTTP_REFERER` so you get redirected back to the person you have impersonated once you stop.
## Screenshots:
See merge request !1702
- Offloads uploading to GitLab Workhorse
- Use /authorize request for fast uploading
- Added backup recipes for artifacts
- Support download acceleration using X-Sendfile
- Add page titles to CI settings.
- Fix CI admin navigation.
- Remove duplicated scope.
- Use monospace font for commit sha.
- Add page title and header title to build page.
- Proper authorization for cancel/retry builds.
- Use gitlab pagination theme for builds and group members.
- Don't paginate builds widget on build page.
- Add badges to commit page Changes/Builds tabs.
- Add "Builds" to commit Builds tab page title.
- Add and use Ci::Build#retryable? method.
- Add CI::Build#retried? method.
- Allow all failed commit builds to be retried.
- Proper authorization for cancel/retry all builds.
- Remove unused param.
- Use time_ago_with_tooltip where appropriate.
- Tweak builds index text
- Remove duplication between builds/build and commit_statuses/commit_status.
- Use POST rather than GET for canceling and retrying builds.
- Remove redundant URL helpers.
- Add build ID to build page.
- Link branch name on build page.
- Move commit/:sha/ci to commit/:sha/builds.
Modifies the existing "login as" feature to be called impersonation, as
well as keeping track of who is impersonating to revert back to that
user without having to log out.
Add ability to remove the fork relationship from project settings
Replaces !1579.
Fixes#2578.
See merge request !1636
This was previously possible through the API but can now be done
through the project#edit settings screen if the current user is
the owner of the project.
Update changelog
Cleanup CI pages
- [x] Remove `ci/projects/:id` page
- [x] Remove Continuous integration from project menu
- [x] Remove unused css/js
- [x] Remove Ci::Commit and Ci::Build controllers
- [x] Move CI services to project settings area
cc @ayufan
Part of #2594
See merge request !1529
Robert Speicher
Drew Blessing
Dmitriy Zaporozhets
Douwe Maan
Zeger-Jan van de Weg
Andrew Tomaka
Valery Sizov
Robert Speicher
Kamil Trzcinski
Jason Lee
James Newton
Han Loong Liauw
Stan Hu
